From 1 June 2025, where a data controller has reason to believe a personal data breach has occurred it must notify the Commissioner as soon as practicable in the manner and form the Commissioner determines. Under Circular 2/2025 and the Data Breach Notification Guideline a breach is notifiable where it causes or is likely to cause significant harm: risk of physical harm, financial loss, harm to credit records or damage to or loss of property; misuse for unlawful purposes; sensitive personal data; data that combined could enable identity fraud; or significant scale (more than 1,000 affected data subjects). Notice goes within 72 hours through the JPDP portal form, the dbnpdp@pdp.gov.my form or hard copy, stating the breach details (time detected, data types, cause and how identified, numbers of data subjects and records, affected system), likely consequences, chronology, containment and mitigation, steps for affected data subjects and the DPO contact; missing details follow in phases within 30 days; a late notice states reasons with evidence; each controller in a shared breach notifies separately. The clock runs from confirmation of the breach or the processor's report, whichever is earlier. Failure is an offence (fine up to RM250,000, imprisonment up to two years or both).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.